Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2026-18243

HP DesignJet T3500 - Potential Cross-Site Scripting (XSS)

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hp
Products
Designjet T3500
CVE-2025-9291

Improper Certificate Validation in TP-Link Omada Cloud Communications

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Ds1008x Omada Ds1008x Firmware and 218 more
CVE-2025-15544

Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Omada Omada App Omada Controller and 228 more
CVE-2025-15627

Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Omada Controller Omada Ds1008x Omada Ds1008x Firmware and 225 more
CVE-2025-15628

Hardcoded Certificates in TP-Link Omada Device Communications

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Points Omada Controller Omada Ds1008x and 226 more
CVE-2025-15629

Weak Session Key Generation in TP-Link Omada Adoption Protocol

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Controller Omada Ds1008x and 225 more
CVE-2025-15630

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Controller Omada Ds1008x and 225 more
CVE-2025-15631

Weak Credential Storage in TP-Link Omada Devices

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Ds1008x Omada Ds1008x Firmware and 219 more
CVE-2026-48031

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin roles, and completely bypass authentication on all protected endpoints. This value is set in two places: the dev.env template (line 10) and a programmatic fallback in cmd/serve.go (line 35), so the application uses it even when no .env file is present. The original mitigation in auth/jwt/tokenauth.go (lines 22 to 25) only caught the exact string "random", letting other weak secrets through, and replaced it with an in-memory key that was not persisted, invalidating all tokens on every restart and effectively causing a denial-of-service. This issue has been fixed in version 2026-05-18.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Dhax
Products
Go-base
CVE-2026-67599

ClearOS 7.9 OS Command Injection via Log Viewer filter parameter

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webconfig user, and due to extensive NOPASSWD sudo privileges granted to that user by default, immediately escalate to root.

CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed
Vendors
Clearfoundation
Products
Clearos
CVE-2026-68980

Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Nifi
CVE-2026-47211

Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI. This issue has been fixed in version 0.39.0.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Q00
Products
Ouroboros
CVE-2026-48063

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Whiskeysockets
Products
Baileys
CVE-2026-18667

Sensor Proxy Version 1.4.2 Fixes One Vulnerability

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Tenable
Products
Sensor Proxy
CVE-2026-11835

Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Caliptra
Products
Core Rom
CVE-2026-16547

REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pete Nelson Wordpress
Products
Rest Api Log Wordpress
CVE-2026-67243

Unrestricted File Upload Enabling Arbitrary OS Command Execution in Freo2

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Refirio
Products
Freo2
CVE-2026-18754

Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Geovision Inc.
Products
Gv-as1620 (gv-cloud)
CVE-2026-18759

An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Asustor
Products
Abp And Aes